Export_User

As the title says, we've just found out that, when our techs move machines into a workgroup, the Windows LAPS password no longer works. Is this intentional? Or have we messed up something in the LAPS policy? I don't know why the password would stop working when moving it off the domain.

We're deploying the Win11 23H2 update the usual way, alongside our normal Windows Updates as an IPU using the new UUP upgrade that gets updated every month. However, on some machines, the keyboard language is reverting back to default after the upgrade.

We build all our machines with the same en-US image, but set the keyboard layout to the local country during the TS. When upgrading these machines we're seeing the keyboard revert back to en-US instead of respecting the current language being set... this causes users to get locked out at first logon.

FYI - we block the MS Store, and optional features, so we're forced to add languages via an ISO, or a manual download from the online Store of

I'm distributing the Company Portal to some test users (Win11) via MECM, as we block the Store (by enabling the Private Store). The app installs without any issues, but it fails to open. It starts to load up, then closes immediately, no errors.

Where do I start troubleshooting Company Portal issues?

I've looked under "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs" and saw some FW issues in the ClientHealth.log, which have been resolved, but can't see any logs related to the app itself.

One other thing to note is that we are disabling Winget via GPO, I don't know if the Company Portal has a dependency on this or not, but I thought it worth mentioning.

I've been trying to push this feature upgrade to some pilot Win10 machines, as I want to upgrade our users straight to 23H2, but I can't figure out why this update isn't downloading and is stuck at 0%. I've looked at some of the previous posts here, but can't find a solution for it.

Here's our current setup:

• Site Server = Version 2309 + Hotfix
• UpdateServiceUrlAlternate = http://localhost:8005
• Delivery Optimization = 99 (Simple)
• Download delta content = Enabled

The upgrade stays at 0% for about 30 mins then fails, subsequent retries are met with 0x80070005 access denied.

Has anyone managed to resolve this issue?

We've recently run into some issues, whilst testing our Windows 11 rollout, with the May CU (KB5037771) and I can't seem to find anything about it online.

Issues seen so far:

• Users without a cached profile not able to log in: "The User Profile Service service failed the sign-in".
• Unable to start the MECM service, Software Center shows a blank white screen.
• Unable to connect via VPN whatsoever, service fails to start.
• Random applications crash and/or behave unexpectedly.
• Unable to uninstall KB5037771 - 0x8000ffff (catastrophic failure).

What's interesting is that (so far) this only seems to affect machines that have either been upgraded from Win10 via an ISO or IPU Task Sequenc

I've just started testing our Windows 11 in-place upgrades in our environment with a TS, and I'm encountering issues when trying to reboot the client after the OS installs. The TS seems to fail with the below error logs.

Also, at the very bottom one of the error lines seems to have a typo "Error to resume task seqauence." which I find a little unusual. I googled it and it points to to an old issue that was supposedly resolved in 1910: [Summary of changes in Microsoft Endpoint Configuration Manager current branch, version 1910 - Microsoft Support](https://support.microsoft.com/en-us/topic/summary-of-changes-in-microsoft-endpoint-configuration-manager-current-branch-version-1910-b4617a89-

I'm trying to wrap the Dell Command Update CLI into PSADT, so that I can present my users with a prompt to update their drivers. However, my powershell skills are lacking.

I'm stuck on what is probably a really simple problem, but I need to check if the user has the AC power connected (using Test-Battery works well), then present a dialog box to prompt them to connect. I then need it to check again when they press OK and re-prompt if it's still not connected, or proceed onto the installation with the installation progress window.

Is this possible?

This probably going to be an unpopular opinion, but I can't help but express my dissatisfaction with celebrities voicing characters in video games. Let me clarify that this is a personal rant, and I honestly do appreciate, and respect, the talent of the celebrities (and Twitch streamer) involved in bringing Baldur's Gate 3 to life.

The problem I have is that celebrity voices often break my immersion in a game. By having preconceived attachments to these celebrities, positive or negative, it can makes it challenging to fully engage with the characters they portray. I understand that using celebrities can generate interest and boost sales, but to me, they often just feel like marketing tools.

I've run into an issue where the Dell docks I've been using for years (WD19 and WD15) have started to drop their network connection after a few minutes in WinPE across all laptop models. Re-plugging the USB-C dock connection fixes the issue, but only temporarily. The issue doesn't occur with USB-C Adapters, or onboard NICs.

We use the Dell WinPE CABs, version A29 was working fine until recently, so I updated them to version A30, updated the dock firmware, and tried injecting in the Realtek USB FE network driver manually too, all with no luck.

I know I could just use an adapter, but I'd like to resolve this issue to keep the status quo across all sites. Has anyone come across this before?

I'm trying to change the priority of client settings and nothing happens when I do it from the console. I then tried via PowerShell and that also fails with the below error. Has anyone come across this before?

Set-CMClientSettingGeneral -Name "Client Settings" -Priority Increase
Set-CMClientSettingGeneral : Generic failure
CMPSNoMask = True
At line:1 char:1
+ Set-CMClientSettingGeneral -Name "Client Settings" -Priority Increa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Microsoft.Confi...tSettingGeneral:SetClientSettingGeneral) [Set-CMClientSettingGeneral], WqlQueryException
    + Ful

As far as I'm aware, SCCM doesn't have the ability to see/patch user-based installs for things like Chrome, Zoom etc., as they're not visible when running under the system context. This leaves hundreds of vulnerable potentially un-patched, which security obviously doesn't like.

So how do you keep this up-to-date in your environment? Do you restrict all user-based installs? Or do you use app deployments leveraging collections that query the registry? ...or is there another way I'm not thinking of?

We have multiple servers that have been cloned over the years and many of them have duplicate SusClientId. We first noticed the problem when a small handful of servers, that are patched via WSUS, were not appearing in WSUS. Thankfully, we've managed to resolve this by deleting the duplicate IDs and re-authorizing them.

However, everything else is patched by MECM, and there are potentially hundreds of servers with this issue - will this duplicate ID affect MECM in anyway?

I'm really hoping this isn't as big a problem as it seems.

We're unable to create new contacts via the iOS Outlook app. The Create button is available, but they do not appear in the app after being created. No errors, it simply does not show up. Contacts do sync to the device when created from the desktop app, and local phone contacts are not affected.

We have the Device Configuration Profile for Email deployed via InTune and successfully applied to our devices, and the issue is occurring across all iOS devices. We don't have any Android devices in our environment.

Has anyone come across this issue before?

I've got MECM managed machines (workstations and servers) that should only be getting updates from the site server, that are going out to the internet for their Windows Updates. One of our SQL servers went out for the latest CU and rebooted itself, which is an absolute nightmare scenario...

The following settings are enforced:

• DisableDualScan = 1
• DoNotConnectToWindowsUpdateInternetLocations = 1

Is there anything else I'm missing, either in the client settings, GPO, or registry, that can stop this behavior?

Edit: The WUServer and WUStatusServer are also set to the correct URL for the site server.

Update (21/06): Testing "Configure Automatic Updates" = Disabled and "**Remove